Skip to main content

Enterprise Linux CVE-2025-7424

| EUVDEUVD-2025-20995 HIGH
Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)
2025-07-10 secalert@redhat.com
7.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Re-analysis Queued
Apr 27, 2026 - 21:22 vuln.today
cvss_changed
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 16, 2026 - 06:52 euvd
EUVD-2025-20995
Analysis Generated
Mar 16, 2026 - 06:52 vuln.today
CVE Published
Jul 10, 2025 - 14:15 nvd
HIGH 7.5

DescriptionCVE.org

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

AnalysisAI

CVE-2025-7424 is a type confusion vulnerability in the libxslt library where the psvi (Post-Schema-Validation Infoset) memory field is reused for both stylesheet and input document processing, enabling memory corruption during XML transformations. This affects any application using vulnerable libxslt versions to process untrusted XML stylesheets or documents, allowing unauthenticated remote attackers to trigger denial of service or memory corruption without requiring user interaction. The vulnerability has a high CVSS score (7.5) with high availability impact, though real-world exploitation probability and active KEV status require confirmation from official sources.

Technical ContextAI

libxslt is a widely-used XSLT processing library that transforms XML documents using XSL stylesheets. The vulnerability stems from CWE-843 (Type Confusion), where the same memory field (psvi) intended for storing Post-Schema-Validation Infoset data is improperly reused across different contexts—both for stylesheet compilation/validation and input document processing. During XML transformations, this field confusion causes the processor to interpret stylesheet-related metadata as input document data or vice versa, leading to type mismatches in memory access patterns. Affected CPE strings typically include cpe:2.4:a:xmlsoft:libxslt (all versions with this vulnerability), commonly distributed with glibc-based Linux distributions, macOS via Homebrew, and embedded in web servers (Apache with mod_xslt), document processors (LibreOffice via its XSLT engine), and enterprise XML platforms.

RemediationAI

Immediate actions: (1) Identify all systems using libxslt via package managers (apt list --installed | grep xslt, rpm -qa | grep xslt, brew list | grep libxslt) or embedded in applications; (2) Apply vendor-provided patches immediately upon release—monitor xmlsoft.org and your OS vendor's security bulletins for patched libxslt versions; (3) If patches are unavailable, implement compensating controls: restrict XML/XSLT processing to trusted sources only, disable XSLT processing features if not required, run libxslt-dependent services in restricted containers/sandboxes with resource limits to minimize DoS impact. Longer-term: (4) Upgrade to patched libxslt versions once available (follow vendor release notes for specific version numbers); (5) Implement input validation and schema enforcement to reject malformed or suspicious XSLT stylesheets before processing; (6) Monitor for publicly disclosed POCs and adjust response priorities accordingly.

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Vendor StatusVendor

Ubuntu

Priority: Medium
libxslt
Release Status Version
bionic released 1.1.29-5ubuntu0.3+esm3
focal released 1.1.34-4ubuntu0.20.04.3+esm2
jammy released 1.1.34-4ubuntu0.22.04.5
noble released 1.1.39-0exp1ubuntu0.24.04.3
plucky released 1.1.39-0exp1ubuntu4.1
trusty released 1.1.28-2ubuntu0.2+esm5
xenial released 1.1.28-2.1ubuntu0.3+esm4
upstream released 1.1.44,1.1.43-0.1
questing released 1.1.43-0.3

Debian

Bug #1109123
libxslt
Release Status Fixed Version Urgency
bullseye fixed 1.1.34-4+deb11u3 -
bullseye (security) fixed 1.1.34-4+deb11u3 -
bookworm, bookworm (security) fixed 1.1.35-1+deb12u3 -
trixie (security), trixie fixed 1.1.35-1.2+deb13u2 -
forky, sid fixed 1.1.43-0.3 -
bookworm fixed 1.1.35-1+deb12u2 -
trixie fixed 1.1.35-1.2+deb13u1 -
(unstable) fixed 1.1.35-2 -

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.73 Container suse/sl-micro/6.1/baremetal-os-container:2.2.0-3.1 Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2025-7424 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy